Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe
Resource
win10v2004-20240802-en
General
-
Target
9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe
-
Size
47KB
-
MD5
8e600b552764dfc4949d79eab5806a73
-
SHA1
edc84f1276bf01ecd3227e0af771cfe0cd978cc4
-
SHA256
9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117
-
SHA512
19e115df128825c314b968bf08cea2129719c111e69c96eb4619e2f8e4b1137c220f9b3e4f75e938d9cd7d4fb540c85876f41580af8f878543e4e2068bd0c9a8
-
SSDEEP
768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c53hmYoYI/KHI/Kr:W7ZhA7pApM21LOA1LOrtkpt6uYoO
Malware Config
Signatures
-
Renames multiple (1347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe"C:\Users\Admin\AppData\Local\Temp\9d0b36876980d8cb48151ba1a45c341a0c6696d69df1ba0dfd6398560554b117.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5b6e49f66829569f2718dfffd1f8f2c36
SHA1dc53c5165349c4a24bc4cd32c44c98ce6a7f3559
SHA256775f5bfb86d8b09d710dea5b8bcd1cdbdd47181975ac3a57e6eddf69f22d8e7b
SHA512d2d83b9a036171b238e54dcd5025836543a8d11f4af661b136a47af9ca8e5fb55dadbec1f278d535c2bfef6bda742ec7bb0827f6ad4f9e2b53beb3e1d4ce1900
-
Filesize
56KB
MD58607efe069b5da76becee36e39476eb7
SHA1ded29ebd3cc8b9d0e5f703180473c23a82894175
SHA256c05e268579ad07a87b616d5d18f890d24367b7a0ef4c9e1d43b083139064b3c0
SHA5125d8b94662eca28f9bc3b6aa8f79ec94b52bb6ebf3c2a9aa54cb9bb1c5fa1c560629dccd284b6f45922ebb0490a6accd0ceb88704204e2fa8df4af2f79d1b54a8